Plesk Patches Three Flaws That Start From an Ordinary Customer Account

Plesk published advisories on August 25 for three vulnerabilities in its hosting control panel, each with a fix already available. None is described as requiring an administrator login. One could let a customer with an ordinary hosting subscription and a DNS-managed domain read arbitrary server files and recover the panel’s own credentials. One could let an authenticated user reach other customers’ databases. The third could let a user with an unprivileged hosting subscription execute code as root.

The fixes arrive through two separate channels, and that is the operational trap. Two of the flaws are closed by a core microupdate, but the root flaw lives in the Plesk Migrator and Site Import extensions, which are updated separately. A server running a patched panel build can still be vulnerable through an old extension.

There is a further complication. In the comment thread under the extension advisory, some administrators report that the patched Migrator version is not reaching their servers.

Key facts

• CVE-2026-65646, DNS zone management: a customer with a DNS-managed domain could read arbitrary server files and obtain administrative credentials.
• CVE-2026-65642, database management interface: an authenticated user could reach other customers’ databases and view, modify, or delete their data. The only one of the three whose advisory also lists Plesk for Windows.
• CVE-2026-65647, Plesk Migrator and Site Import: an unprivileged user could execute arbitrary code as root.
• Patched in: Plesk 18.0.79.8 and 18.0.80.4, Migrator 2.36.0, Site Import 1.12.1. The core update does not fix the extension flaw.
• Severity and exploitation: the advisories provide no CVSS scores and do not mention exploitation. NVD had no records for the three CVEs as of August 26.

Arbitrary File Reads That End at the Panel’s Own Credentials

CVE-2026-65646 sits in the DNS zone management functionality. Plesk says the flaw “could allow a customer with a DNS-managed domain to read arbitrary files from the server and obtain administrative credentials.” The prerequisite is a feature, not a misconfiguration: the advisory states that servers where customers are permitted to manage DNS records for their own domains are affected.

The advisory spells out where that leads. Disclosure of Plesk administrator and database credentials “would give an attacker full control of the Plesk panel and access to all databases hosted on the server.” A file-read flaw, in other words, can also be a takeover path, because of what the readable files contain.

One detail of the advisory’s own version table is worth noting: it lists Plesk for Linux only. The affected and patched builds for every component are consolidated in the table below.

The Database Flaw Also Names Plesk for Windows

CVE-2026-65642 is in the database management interface. Plesk says it “could allow an authenticated user to gain unauthorized access to databases belonging to other users on the same server,” and that an attacker could “view, modify, or delete data belonging to other Plesk users.” No elevated role is named; the starting point is an authenticated user.

The affected and patched versions match the DNS flaw, and the same microupdate closes both. One difference stands out: this is the only advisory of the three whose table carries a Plesk for Windows row, with the same version ranges and the same patched builds as Linux.

Migrator and Site Import: From an Unprivileged Account to Root

The third flaw, CVE-2026-65647, has the most severe outcome of the set. Plesk says affected versions of the two extensions “could allow an unprivileged Plesk user to execute arbitrary code with root privileges,” and that the issue “does not depend on a particular server configuration. Any server running an affected version is affected.”

The advisory addresses shared hosting directly: “In shared and multi-tenant hosting environments, a successful escalation gives the attacker administrative control of the server and access to all subscriptions hosted on it.” The fix is a new version of each extension.

Both extensions are used to bring sites or hosting data into a Plesk server. BlackTree, an independent security publication that analyzed the disclosures, notes that the extensions perform privileged operations as part of their normal role. It adds that neither flaw it examined requires the attacker to begin as an administrator: accounts “can be purchased legitimately, created for trials, compromised through reused credentials, or retained after a customer relationship changes.”

A Patched Panel Can Still Carry the Root Flaw

The core microupdate fixes the DNS and database flaws. It does nothing for the extensions, which Plesk distributes through a separate channel. The advisory’s instruction for the third flaw is to update the extensions themselves, so a provider who installs the microupdate and stops there can leave the root flaw open if an affected version of either extension remains installed. Where an extension is not needed, PanelLicense notes that removing it removes that extension’s attack surface.

Compiled from the three Plesk advisories. Each row reflects only what its advisory’s own version table states; the DNS advisory lists no Windows row.

For fleets, the check is the panel build plus the installed version, or confirmed absence, of each extension: Migrator and Site Import. BlackTree’s guidance points the same way: verify the installed extension versions independently after updating the panel, and treat any suspected root-level exploitation as a full host compromise.

Administrators Report the Migrator Update Is Not Arriving

As of our capture of the advisory pages on August 26, the comment thread under the extension advisory contained five comments, and they describe a rollout problem. One administrator reported checking random servers and finding 2.35 still offered as the latest Migrator version, in both the interface and the command line. A second administrator reported the same.

The most recent comment in the captured thread, posted roughly an hour before our capture, reports that both plesk bin extension –upgrade panel-migrator and plesk daily -f UpgradeExtensions complete while reporting “The extension was successfully upgraded,” yet the installed version does not change on any server the administrator checked. No reply from Plesk appears in the thread as captured. These are user reports on the vendor’s own advisory page, and we could not verify them independently.

If they are accurate, the situation is uncomfortable in a specific way: the one flaw whose fix cannot come through the core update, the root flaw, is the one whose Migrator update administrators say they cannot obtain.